TECHNOLOGY
Zero Trust controls for shared customer access
A data analytics firm needed rapid access to short-term customer environments without losing accountability when clients only provided shared credentials.
THE CHALLENGE
What needed to change
Customers refused to provision individual RBAC or federated SSO because engagements often lasted less than two weeks. Five analysts sometimes had to use one admin@client.com account, creating compliance risk, zero visibility and no clear answer to questions like: who deleted the table?
THE APPROACH
How Cybergaar responded
Cybergaar routed access through Cloudflare Gateway and identity-aware device policies. Even where the destination application still saw a shared customer account, the gateway authenticated the individual employee before forwarding traffic and preserved a secondary audit trail.
THE OUTCOME
The result
The firm gained practical user-level attribution, safer third-party access sharing, better observability across applications and a lower-cost path to compliance evidence without forcing every customer to redesign their identity stack.
THE CHALLENGE
What created the risk
Shared Credentials
Customers would not create individual accounts or enable SSO for short engagements, so analysts were pushed toward shared logins.
Zero Visibility
Customer-side logs only showed the shared account, leaving no reliable way to identify which internal analyst performed a risky action.
Compliance Risk
Manual onboarding and offboarding created windows where former employees could retain access to critical SaaS tools.
THE SOLUTION
What changed in the architecture
Identity-Aware Proxying
Cloudflare Gateway authenticated the employee via the WARP client before traffic reached the shared customer account.
Hardware-Identity Bind
Password vault access was tied to corporate email and approved device posture so shared credentials could only be used from trusted endpoints.
Granular Traffic Inspection
HTTP/HTTPS logging captured visited URLs and API calls at the edge so activity could be reconstructed after the fact.
TECHNICAL HURDLES & MITIGATIONS
Issues handled during the engagement
Issue
VPN vs. Zero Trust Conflict: analysts needed to simulate traffic from countries such as Brazil, but VPN software conflicted with the Zero Trust client.
Architecture fix
Configured browser-level SOCKS5 proxies so country-specific testing could continue without breaking endpoint routing.
Issue
Log Retention on Free Tier: Cloudflare free/standard retention windows were too short for 90-day audit evidence.
Architecture fix
Implemented a weekly export process for CSV logs so the client could retain evidence outside the dashboard.
STORY STATUS